Change effective on 14 August 2018
Private Spaces now has public beta support for configuring a connection to another private network using IPSec VPN. This lets dynos connect to hosts on your private networks and vice versa. The connection is established over the public Internet, but all traffic is encrypted using IPSec.
Create VPN connections using the Heroku CLI:
$ heroku spaces:vpn:connect \ --name office \ --ip PUBLIC_IP_OF_YOUR_VPN_GATEWAY \ --cidrs ROUTABLE_CIDRS_OF_YOUR_PRIVATE_NETWORK \ --space SPACE
See the VPN Connection Dev Center article for details on how to get started.